Important security update: Protecting our community from a recent invoice scam

We are actively investigating this issue and have already taken steps to mitigate the threat. Please be assured that no Lumin customer accounts, data, or systems have been breached. This is an abuse of our free account tier, not a compromise of our platform.

Here is everything you need to know about how this scam works and how to stay safe.

How the scam works (the mechanism)

Over the last few days, we have detected that bad actors have been exploiting Lumin to bypass email spam filters. Because the emails originate from our trusted servers, they look legitimate to email providers and land directly in the victim's inbox.

Here is the step-by-step mechanism of the scam:

1. Creation of free accounts: Scammers create free Lumin accounts and use our system to send out documents to large, pre-existing lists of stolen email addresses (predominantly targeting people in the United States).
2. Fake invoices: The document sent is a fraudulent invoice, usually disguised as a receipt from PayPal. These fake invoices claim that the recipient has recently been charged for high-ticket items, most commonly BTC (Bitcoin) or McAfee Antivirus subscriptions.
3. The trap (fake phone number): The invoice displays a very large unauthorized charge and prominently features a "Customer Support" or "Fraud Prevention" phone number. The document urges the victim to call this number immediately if they did not authorize the purchase.
4. Social engineering: If a panicked victim calls the number, they are not connected to PayPal or Lumin. Instead, they are connected directly to the scammers, who will use manipulative tactics to steal financial details, passwords, or direct payments under the guise of "processing a refund."

As far as we are aware, this scam has been prevalent on other platforms like DocuSign for several years. However, we detected this scam running via Lumin services for the first time this week.

What you should do

If you or anyone you know receives an unexpected invoice via Lumin Sign (or any other eSignature platform) claiming you have purchased Bitcoin, McAfee, or other products:

• DO NOT call the phone number on the invoice. This is the primary goal of the scammers.
• Do not click on any unverified links within the document.
• Verify independently: If you are worried about a charge, open a new browser window, navigate directly to your PayPal or bank account, and check your recent transactions. You will see that no such charge exists.
• Report and delete: Delete the email. If you wish, you can forward the document to our support team so we can continue tracking the abusers.

What we (Lumin) are doing to stop this

Our security team is actively working behind the scenes to shut this activity down. To protect our platform and community, we are:

• Removing fraudulent accounts: We are constantly identifying and shutting down accounts that abuse our services.
• Upgrading our defense systems: We are updating our security tools to better catch and block these fake documents before they reach anyone.
• Monitoring for suspicious activity: Our team is tracking unusual behavior on the platform to stop new threats as they pop up.

A note to our enterprise and paying customers

We have no reason to believe that our paying customers (or your clients) have been or will be impacted by this issue. This scam relies on bulk-sending to external phishing lists, and your data remains secure. You can trust to continue using our API and services as normal.

We will continue to post status updates on our website as we roll out further security measures to permanently block this threat. If you observe any API issues or have any questions over the next few days, please do not hesitate to reach out to our support team.

Stay safe,

The Lumin Team